Cloud firewalls: a push when a port opens to the internet
A DigitalOcean cloud firewall is a network-based, stateful firewall for droplets that blocks all traffic a rule does not expressly permit, at no additional cost. Duskwatch is an independent iPhone app for DigitalOcean, in development; it sends a push when a cloud firewall opens SSH, RDP, a database port or every port to the whole internet, or fails to apply, and shows what each droplet's firewalls expose as findings.
Updated
A push when a sensitive port opens
Most exposed databases were not exposed on purpose. Someone opens port 5432 to everyone to debug a connection at midnight and forgets to close it. If you turn on alerts, when a firewall in your team gains a rule that opens a sensitive port to 0.0.0.0/0 or ::/0, you get one push. "Also when a sensitive port opens to the internet" is on by default in the firewall rule, and you can turn it off there.
"fw-web: sensitive port open to the internet" · acme-prod · SSH, a database port or all ports.
| Kind | Ports | An inbound rule that sends the push |
|---|---|---|
| SSH | 22 | TCP 22 from 0.0.0.0/0 |
| RDP | 3389 | TCP 3389 from ::/0 |
| Database | MySQL 3306, PostgreSQL 5432, Redis 6379, MongoDB 27017, Elasticsearch 9200, Memcached 11211, CouchDB 5984 | TCP 5432 from 0.0.0.0/0 |
| All ports | Every TCP port, or a range that covers nearly all of them | TCP all ports from 0.0.0.0/0 |
The push marks a change, not a state, so it is sent once: no repeats and no recovery push. It counts only firewalls applied to a droplet or a tag, only TCP rules, and only new exposure. A firewall that already had port 22 open when you turned on alerts shows as a finding on its droplets instead, and a deny rule for the whole internet that covers the port cancels it out.
When a firewall fails to apply
A firewall you can see in the control panel is not always a firewall that is working. When DigitalOcean reports that a firewall failed to apply its rules, the droplets behind it may be filtered differently from what the rules say. With alerts on, that sends a push, and a second one when the firewall applies again.
"fw-web failed to apply" · acme-prod · Its rules may not protect its droplets.
"fw-web applied" · acme-prod
The API reports a firewall's status as waiting, succeeded or failed.
DigitalOcean API reference: firewalls (external link), verified
Cloud firewalls are network-based and stateful, block all traffic that is not expressly permitted by a rule, and are provided at no additional cost.
DigitalOcean docs: Cloud Firewalls (external link), verified
What the app shows on each droplet
There is no firewall screen. Tapping a firewall push opens the Alerts tab, and the day-to-day picture lives on the droplet's screen, in its network section. There the app adds up every firewall applied to the droplet and turns what they expose into findings, each with the evidence and a next step.
| Finding | Evidence | Next step the app suggests |
|---|---|---|
| All TCP ports are open to the internet | 0.0.0.0/0 → all TCP | Allow only the ports you serve, such as 80 and 443 |
| Postgres (5432) is open to the internet | 0.0.0.0/0 → 5432 | Allow these ports only from your app droplets, tags or VPC |
| SSH is open to the internet | 0.0.0.0/0 → port 22 | Limit port 22 to your IP in the firewall |
| Firewall rules failed to apply | fw-web | Check the firewall in DigitalOcean |
| No cloud firewall | A public IP and no firewall | Attach a cloud firewall in DigitalOcean |
A droplet can be protected by more than one cloud firewall, and the union of their rules applies: if one allows TCP from any source, TCP is allowed from anywhere.
DigitalOcean docs: create a cloud firewall (external link), verified
How ports end up open to everyone
- The suggested first rule. A new firewall proposes SSH from anywhere, so the server can be reached from a terminal, and it is easy to keep.
- A tag. Add a tag to a firewall and every droplet with that tag joins it, including the one created tomorrow.
- A second firewall. Because rules add up, a broad rule on one firewall undoes a narrow rule on another.
- A debugging session. A database port opened to test a connection outlives the test.
When you create a firewall, the suggested rule allows SSH connections on port 22 from anywhere, so the server can be administered from a terminal.
DigitalOcean docs: create a cloud firewall (external link), verified
When you add a tag to a firewall, any droplets with that tag are automatically included. Rules can allow or deny traffic, and a deny rule takes precedence over an allow rule that matches the same traffic.
DigitalOcean docs: Cloud Firewalls features (external link), verified
Each firewall can have up to 50 incoming and outgoing rules in total, 10 droplets and 5 tags.
DigitalOcean docs: Cloud Firewalls limits (external link), verified
One more read-only permission
Firewall alerts read your firewalls with one extra read-only permission, shared with Kubernetes, load balancers and certificates. If a team's alerts were set up without it, the app asks once: "Watch Kubernetes, load balancers, certificates and firewalls." DigitalOcean then shows its own consent page, and your alert history and settings stay. If you untick firewalls there, the app says so: "DigitalOcean didn't allow firewalls. Those alerts stay off."
The alert server can still only look, never change a rule. What it keeps about a firewall is its ID and which kinds are open, such as SSH or a database port, never the ports, addresses or rules themselves. Firewall alerts are never held back during a DigitalOcean incident.
What Duskwatch doesn't do here
- No firewall screen and no editing rules: changes happen in DigitalOcean.
- No push for a port that was already open when you turned on alerts; the droplet shows it as a finding.
- No push for UDP or ICMP rules, outbound rules, or rules open to a specific address range.
- No push for other ports open to the internet, such as a web server on 8080.
Questions
Will I get a push if someone opens port 22 to the internet?
Yes, with alerts on. When a firewall applied to a droplet or tag gains a rule that opens SSH, RDP, a database port or all ports to 0.0.0.0/0 or ::/0, you get one push.
Does it push for a firewall that already had SSH open?
No. The push is for a change; a port that was open before you turned on alerts shows as "SSH is open to the internet" on each droplet behind it.
What happens when a firewall fails to apply?
With alerts on, you get "fw-web failed to apply", and another push when it applies again. The droplets behind it also carry the finding "Firewall rules failed to apply".
Can I change firewall rules from Duskwatch?
No. The app and its alert server only read firewalls. Open DigitalOcean to change a rule.
Which ports count as sensitive?
SSH on 22, RDP on 3389, the usual database ports such as PostgreSQL on 5432 and MySQL on 3306, and every port at once.